Directorist CVE-2026-84150

Requires an authenticated WordPress account with at least subscriber-level access on a site running Directorist before 8.9.5 (PR:L). The attacker invokes the plugin's user-favorites REST route and supplies another user's identifier as the target; the vulnerable code path performs no ownership check tying the target user to the authenticated caller. Limiting factors: a valid account is mandatory (no unauthenticated path), no user interaction from the victim is needed, and the impact is confined to reading and altering another user's saved favorites - there is no availability impact and no access to broader account credentials or admin functions.

Real-world risk is MODERATE-LOW. The WPScan-assigned CVSS of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is internally consistent with a CWE-639 IDOR: network-reachable REST route, low complexity, but requires an authenticated subscriber-level account (PR:L) and yields only limited confidentiality and integrity impact (viewing/altering another user's saved favorites - low-value data, no availability impact). No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is NO conflict between the CVSS network vector and the description - both point to a remotely-reachable but authentication-gated flaw. The one metadata discrepancy is the 'Authentication Bypass' tag, which mislabels the issue: this is a broken-object-level-authorization (IDOR) flaw where an authenticated user acts across object boundaries, NOT a bypass of authentication itself. This is a genuine but low-priority issue - the impact ceiling (tampering with another account's favorites list) is minor, and exploitation requires a valid account, so it is not a mass-exploitation candidate. Patching is warranted on normal cadence rather than emergency.

An attacker registers or already holds a subscriber-level account on a WordPress site running Directorist, then calls the favorites REST route while substituting another user's ID as the target. Because the endpoint never checks that the target user matches the authenticated caller, the attacker reads and modifies the victim's saved favorites. No public exploit code is identified at the time of analysis; exploitation is low-complexity but requires a valid low-privilege account.